CVE-2022-22990

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-22990
A limited authentication bypass vulnerability was discovered that could allow an attacker to achieve remote code execution and escalate privileges on the My Cloud devices. Addressed this vulnerability by changing access token validation logic and rewriting rule logic on PHP scripts.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.4 / Impact : 5.8

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

8.3 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:A/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 6.5 / Impact : 10.0

Access Vector ADJACENT_NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
https://www.westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117 Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-22-076/ Third Party Advisory VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-347/ Third Party Advisory VDB Entry
https://www.westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117 Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-22-076/ Third Party Advisory VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-347/ Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:westerndigital:my_cloud_os:*:*:*:*:*:*:*:*
OR cpe:2.3:h:westerndigital:my_cloud:-:*:*:*:*:*:*:*
cpe:2.3:h:westerndigital:my_cloud_dl2100:-:*:*:*:*:*:*:*
cpe:2.3:h:westerndigital:my_cloud_dl4100:-:*:*:*:*:*:*:*
cpe:2.3:h:westerndigital:my_cloud_ex2_ultra:-:*:*:*:*:*:*:*
cpe:2.3:h:westerndigital:my_cloud_ex2100:-:*:*:*:*:*:*:*
cpe:2.3:h:westerndigital:my_cloud_ex4100:-:*:*:*:*:*:*:*
cpe:2.3:h:westerndigital:my_cloud_mirror_gen_2:-:*:*:*:*:*:*:*
cpe:2.3:h:westerndigital:my_cloud_pr2100:-:*:*:*:*:*:*:*
cpe:2.3:h:westerndigital:my_cloud_pr4100:-:*:*:*:*:*:*:*
cpe:2.3:h:westerndigital:wd_cloud:-:*:*:*:*:*:*:*
History

21 Nov 2024, 06:47

Type Values Removed Values Added
CVSS v2 : 8.3
v3 : 8.8 		v2 : 8.3
v3 : 7.8
References () https://www.westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117 - Vendor Advisory () https://www.westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117 - Vendor Advisory
References () https://www.zerodayinitiative.com/advisories/ZDI-22-076/ - Third Party Advisory, VDB Entry () https://www.zerodayinitiative.com/advisories/ZDI-22-076/ - Third Party Advisory, VDB Entry
References () https://www.zerodayinitiative.com/advisories/ZDI-22-347/ - Third Party Advisory, VDB Entry () https://www.zerodayinitiative.com/advisories/ZDI-22-347/ - Third Party Advisory, VDB Entry

11 Jul 2023, 19:56

Type Values Removed Values Added
CWE CWE-287 CWE-697

17 Mar 2022, 17:57

Type Values Removed Values Added
References (MISC) https://www.zerodayinitiative.com/advisories/ZDI-22-347/ - (MISC) https://www.zerodayinitiative.com/advisories/ZDI-22-347/ - Third Party Advisory, VDB Entry

15 Feb 2022, 16:15

Type Values Removed Values Added
References
  • (MISC) https://www.zerodayinitiative.com/advisories/ZDI-22-347/ -

21 Jan 2022, 02:30

Type Values Removed Values Added
References (MISC) https://www.zerodayinitiative.com/advisories/ZDI-22-076/ - (MISC) https://www.zerodayinitiative.com/advisories/ZDI-22-076/ - Third Party Advisory, VDB Entry
References (MISC) https://www.westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117 - (MISC) https://www.westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117 - Vendor Advisory
CPE cpe:2.3:h:westerndigital:my_cloud_ex2_ultra:-:*:*:*:*:*:*:*
cpe:2.3:h:westerndigital:my_cloud_mirror_gen_2:-:*:*:*:*:*:*:*
cpe:2.3:h:westerndigital:my_cloud_dl2100:-:*:*:*:*:*:*:*
cpe:2.3:h:westerndigital:my_cloud_ex2100:-:*:*:*:*:*:*:*
cpe:2.3:h:westerndigital:my_cloud_pr4100:-:*:*:*:*:*:*:*
cpe:2.3:h:westerndigital:my_cloud_dl4100:-:*:*:*:*:*:*:*
cpe:2.3:o:westerndigital:my_cloud_os:*:*:*:*:*:*:*:*
cpe:2.3:h:westerndigital:my_cloud_ex4100:-:*:*:*:*:*:*:*
cpe:2.3:h:westerndigital:wd_cloud:-:*:*:*:*:*:*:*
cpe:2.3:h:westerndigital:my_cloud_pr2100:-:*:*:*:*:*:*:*
cpe:2.3:h:westerndigital:my_cloud:-:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : 8.3
v3 : 8.8
CWE CWE-287

17 Jan 2022, 15:15

Type Values Removed Values Added
References
  • (MISC) https://www.zerodayinitiative.com/advisories/ZDI-22-076/ -

13 Jan 2022, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2022-01-13 21:15

Updated : 2024-11-21 06:47

NVD link : CVE-2022-22990

Mitre link : CVE-2022-22990

CVE.ORG link : CVE-2022-22990

JSON object : View

Products Affected

westerndigital

  • my_cloud_ex2100
  • my_cloud_pr4100
  • my_cloud_dl2100
  • my_cloud
  • my_cloud_ex4100
  • my_cloud_mirror_gen_2
  • my_cloud_pr2100
  • my_cloud_os
  • wd_cloud
  • my_cloud_dl4100
  • my_cloud_ex2_ultra
CWE
CWE-287

Improper Authentication

CWE-697

Incorrect Comparison